Privacy notice — draft

Account security and alerts: account-session limits are separate from vault locking. In the Android app, leaving starts a ten-minute vault-lock countdown and a separate thirty-minute account-sign-out countdown immediately. While the app stays open, both start after sixty seconds without activity. Activity or returning resets countdowns that have not expired. An expired vault stays locked until you unlock it; a vault timeout does not sign out your account. Background requests do not renew the account session. Recognition uses a random identifier for an app installation or browser, stored as an account-specific keyed hash on the server, a broad device/browser description and an approximate network country when the hosting edge supplies it. It does not use GPS or vault contents and does not prove who is holding a physical device. VPNs, mobile networks, clearing browser data or reinstalling can change recognition. The first completed authenticator/passkey sign-in establishes a baseline. Later unfamiliar completed sign-ins can trigger an email to the verified sign-in address. Recognition expires after 90 days without a recorded sign-in and is bounded to 100 recent device/country combinations per account. Alert records include the recipient, broad description/country, time, reason and delivery attempts; maintenance removes records older than seven days. Account deletion removes these account-security records. Sign-in alerts use the existing Resend service, contain no passwords, codes, API keys or vault contents, and are limited to three per hour and six per day per account, with repeated device/country alerts suppressed for 24 hours. Delivery attempts are bounded and expire within 23 hours; delivery can fail or be delayed. Change your account password if an alert is unfamiliar; this ends other account sessions. What Developer Locker API stores for your account: your email address and whether you have verified it, a password verifier (never the password itself), your authenticator setup protected by a server key, sign-in sessions and second-factor checks, and optional reset contacts that you confirm with a code. Optional passkeys store only public credential material and identifiers; the passkey's private key stays with you. The current Android revision stores encrypted vault contents in the app's private device storage without cloud synchronization. This includes API values, passwords, notes, credential labels, providers, accounts, purposes, statuses, expiry dates, risk tags, app/service/environment/variable mappings and older private vault lists. A random vault data key is wrapped using a key derived from your separate vault passphrase; this revision accepts only the supported Argon2id vault format. Account services remain online. The preview profile rejects new hosted vault uploads. Browser vault access remains disabled. Where one-time send is enabled, you can explicitly send one saved item or a batch of up to five saved API keys, tokens, passwords or notes to a temporary browser receiver signed in to the same account. The phone encrypts the selected contents for that tab using a separate recipient key; batch labels are included inside the encrypted contents. The service relays ciphertext without the decryption key. Selected items retain their authentication requirements, with confirmation bound to the selected batch. Pairing expires after two minutes and the complete ciphertext can be collected once. The receiver clears all displayed items after one minute, on Clear, or when hidden or left; it does not save the received items in browser storage. Technical size limits apply; oversized batches are refused in full without truncating notes or sending a partial batch. This is not a web vault or synchronization. Browser memory, clipboard history, pasted values and recipient-created copies cannot be guaranteed erased. Use only synthetic values during staging tests. Installing this revision does not erase legacy server vault copies or provider backups, which require a separately verified and authorized cleanup procedure. Your vault passphrase is not sent to the service. Stored secret values and local password/note documents use a separate random value key. Device copies of the vault and value keys are protected by an Android Keystore wrapping key; hardware backing depends on the phone. The app's native code temporarily uses unwrapped keys to perform operations. Your 24 recovery words derive a key that protects portable copies of the vault and value keys in a complete encrypted backup; the words are not the stored keys and cannot recreate missing vault contents. Your recovery words are not sent to the service. Older fingerprint-only entries remain readable as metadata; a fingerprint is not anonymous and cannot recover a value that was never stored or prove that a key is valid or revoked. Device authentication may use a supported strong biometric or the device screen-lock credential, depending on the operation, Android version and enrolled authenticators. Anyone with a compromised or unlocked phone could see what you reveal there. Optional complete encrypted .devlock backups are point-in-time files saved to storage you select, including compatible USB drives or third-party document providers. A provider may synchronize exported files under its own settings; Developer Locker API does not host or automatically synchronize these backups. Keep a tested backup and recovery information separately. Protected local-vault operations require online authentication to the account bound to that local vault. A supported complete .devlock backup and its 24 recovery words can instead restore vault contents into an empty local vault under an authenticated destination account, including a new account after deletion of the original. Choose a vault passphrase for the restored vault; this route preserves the backup’s recovery words. Restoration rebinds and re-encrypts the recovered contents for the destination; it does not recreate a deleted account’s login, billing or security history. Creating an account with the same email alone does not recover data. The complete backup and required recovery material are still needed, and unavailable destination authentication can prevent restoration. An account-password reset does not decrypt the vault. Device loss, clearing app data or uninstalling can permanently lose contents without a recoverable backup. A successful export confirms writing completed, not that a backup was independently restored or disconnected. Exported copies are not erased by deleting app entries or the account. Keep your 24 recovery words safe. To restore your downloaded backup, use those words, or—if that backup was exported with the alternate route enabled—all three together: the account password and vault passphrase used when the backup was created, plus its registered, backup-capable passkey. Without one complete recovery route, the data in the backup cannot be recovered. Restoring with 24 recovery words preserves those words. Restoring through the alternate route creates a new recovery-word set for the newly restored vault. Unlock the restored vault, then save and confirm those new words before using it. Ordinary locking, sign-in and app switching do not replace confirmed recovery words. Codes for verification and password resets are sent by an email provider (and a text-message provider, if you add a phone number). To limit abuse, the service keeps short-lived counters keyed by a secret hash of your network address and account; raw addresses are not kept in those counters. Hosting and security providers may process network and device metadata (such as IP address and browser type) to deliver and protect the service. Public directory browsing needs no account, vault or authenticator. Creating or editing free directory lists and Favorites requires a free signed-in account, but no subscription, vault or authenticator. Free directory lists save unencrypted in this browser or app profile, without cloud sync. They are shared by anyone using that profile, are separate from encrypted vault backups, and remain after sign-out or account deletion. Do not store passwords or API keys in these lists. Links to providers open their own sites; Developer Locker API tells your browser not to send which Developer Locker API page you came from, and does not record which provider links you open. Provider links come from public sources; price comparisons and price-change alerts are not offered. The support assistant answers from built-in help articles on your device; what you type into it is not sent to Developer Locker API or to an AI service. Purchases are disabled in this preview. If enabled, Google Play handles payments; Developer Locker API processes purchase tokens, a pseudonymous account binding, entitlement state and charge and cancellation evidence, without receiving card details. Terms acceptance stores your account ID, the Terms version and hash, the time and your locale. Public deletion requests record the submitted email and request time pending identity verification; recording a request does not complete deletion, and a monitored verification and fulfillment workflow still requires release acceptance. Developer Locker API has no advertising or analytics SDKs and does not sell or share personal data for advertising. Vault contents are encrypted locally. Account and billing metadata are not end-to-end encrypted. Verified deletion removes active server account records and legacy server vault/private-list content without waiting for billing to settle. Local vault files, unencrypted free lists and user-controlled backups are separate; account deletion does not automatically erase them or ensure they can still be opened. Authentication for the existing local vault can become unavailable after deletion. Export and test a complete backup before deleting the account; compatible recovery-word restoration can recover its contents into an empty vault under a new authenticated account, but creating an account alone does not recover data. A protected deletion tombstone suppresses restored server accounts. Separately retained minimal Play records have their account reference removed but retain the purchase token, pseudonymous binding and charge and cancellation evidence needed to finish reconciliation. Pseudonymous does not mean anonymous; these records require restricted access and a justified retention policy. The legal basis, operator access and maximum retention period require owner/legal review before consumer launch. Deletion queues cancellation of linked Play renewals, not confirmation; check directly through Google Play during an outage. It does not revoke provider credentials. No fixed production retention promise has been approved. The earlier working proposal for security metadata and encrypted backups was 30 days; hosted jobs, backup expiry and restore/deletion drills require operational verification before this can become a consumer promise. No guaranteed production backup-expiry or recovery time has been established. Submitting a public deletion request only records it for identity verification; it does not bypass MFA, delete content immediately or cancel billing. The service runs on Cloudflare Workers with a Cloudflare D1 database; the staging service at staging.devlockapi.com is for test accounts. A complete contractual processor inventory, storage regions and international-transfer safeguards have not yet been confirmed. Apple distribution is planned; no Apple purchase integration or Apple billing-data collection is claimed for this build. Resend is configured for staging verification, password-reset and account-security email, with aiprobldr@devlockapi.com as the configured sender. Configuration is not proof of successful delivery; live inbox delivery and provider access/retention settings remain release checks. The app offers only delivery channels configured on its backend. For verification and resets, the provider receives the destination email, one-time code, purpose and delivery metadata. Security-alert metadata is described above. Delivered email is processed and stored by the recipient's and sender's mail providers under their terms. Vault contents, vault encryption keys, authenticator seeds and vault passphrases are never included in those messages. Provider template-history settings still require operational verification. Developer Locker LLC is the owner-confirmed South Carolina operator; support/privacy/security/legal requests use aiprobldr@devlockapi.com. The intended audience is U.S. users 13+. Applicable minor-consent/capacity requirements remain subject to verification. Legal bases/rights, processors, transfer safeguards, confirmed retention periods, applicable access/correction/deletion/export/complaint rights and their request route, age/child-directed-service rules, and final effective date are pending owner/legal review. Browser storage supports authentication and trusted-device functionality; no optional marketing-cookie consent is bundled into Terms. No sale, advertising-targeting or production cross-border compliance conclusion is established by this draft. This private draft is not a completed consumer privacy policy.